Security Onion Trial - Web Interface not available

[cyrisk-bot]

So I have been working on standing up a standalone Security Onion instance in AWS. Ran through the Instance creation, SSHed in and ran the ungodly long setup, which completed without errors. However, when I try to access the web interface, which has a static public IP (on the instance) it doesn't connect and kicks over to the internal private IP, which of course doesn't connect. Thoughts?

[reyesj2]

https://docs.securityonion.net/en/2.4/cloud-amazon.html#manager-setup

What web access method did you choose? You may need to switch to "hostname" or "other".

[cyrisk-bot]

IP I do believe. I'll give hostname a try. Any trick to editing that option?

[jertel]

Only use hostname option if that VM's public hostname is resolvable both to analyst workstations and to all nodes in the grid.

The simpler option is to use OTHER during install, and then enter the public IP of the VM's primary net interface on the subsequent setup screen. This is explained further in the documentation.

Editing an existing install is possible but more complex, and typically involves SSH'ing into the manager VM and adjust the url_base value stored in the /opt/so/saltstack/local/pillar/global/soc_global.sls to a value matching the VM's public IP. You might also need to adjust the soc_host of the soc_sensoroni.sls pillar as well as others, but only if you notice other grid nodes failing to reach the manager. Once you made the edits you can apply the change by forcing a high state, or simply rebooting the manager VM.

[cyrisk-bot]

I don't seem to be able to re-run setup, so how can I change the web access method?

[cyrisk-bot]

Just saw your reply. Why doesn't Security Onion have the ability to rerun setup? How do I access /opt/so/saltstack/local/pillar/global/soc_global.sls? I'm pretty green on SSH.

[cyrisk-bot]

NM. Figured that out. Just don't know how to use the text editor. More Gemini.

[cyrisk-bot]

None of the command line stuff is working. Is my only option to basically recreate the instance?